[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HNAMBN7TATQ063PZPWRXSM":3,"skill-same:01M6HNAMBN7TATQ063PZPWRXSM":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6HNAMBN7TATQ063PZPWRXSM","performing-malware-persistence-investigation",null,"Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-malware-persistence-investigation\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"performing","persistence","malware","investigation","performing malware persistence investigation","rootkit-detection","scheduled","de","systems","incident","access","how","investigate","linux","malware-persistence","autoruns","forensics","tasks","windows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-malware-persistence-investigation\ndescription: Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- malware-persistence\n- autoruns\n- registry\n- scheduled-tasks\n- rootkit-detection\n- incident-response\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1547\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\ncategory: performing-malware-persistence-investigation\n---\n# Performing Malware Persistence Investigation\n\n## When to Use\n- When investigating how malware maintains presence on a compromised system after reboots\n- During incident response to identify all persistence mechanisms for complete remediation\n- For threat hunting to discover unauthorized autostart entries across endpoints\n- When analyzing malware behavior to understand its persistence strategy\n- For verifying that all persistence has been removed after incident remediation\n\n## Prerequisites\n- Forensic image or live system access with administrative privileges\n- Autoruns (Sysinternals) for Windows persistence enumeration\n- RegRipper for offline registry analysis\n- Understanding of Windows and Linux persistence mechanisms\n- YARA rules for scanning persistence locations\n- Baseline of known-good autorun entries for comparison\n\n## Workflow\n\n### Step 1: Enumerate Windows Registry Persistence\n\n```bash\n# Extract registry hives from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Key registry persistence locations\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nresults = {'registry_persistence': []}\n\n# SYSTEM hive analysis\nsystem_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSYSTEM\")\nselect = system_reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncs = f\"ControlSet{current:03d}\"\n\n# Services (very common persistence)\nservices = system_reg.open(f\"{cs}\\\\Services\")\nfor svc in services.subkeys():\n    try:\n        start_type = svc.value(\"Start\").value()\n        image_path = \"\"\n        try:\n            image_path = svc.value(\"ImagePath\").value()\n        except:\n            pass\n        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled\n        if start_type in (0, 1, 2) and image_path:\n            svc_type = svc.value(\"Type\").value() if svc.values() else 0\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SYSTEM\\\\{cs}\\\\Services\\\\{svc.name()}',\n                'type': 'Service',\n                'value': image_path,\n                'start_type': start_type,\n                'timestamp': str(svc.timestamp())\n            })\n    except Exception:\n        pass\n\n# SOFTWARE hive analysis\nsw_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Machine Run keys\nrun_keys = [\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n]\n\nfor key_path in run_keys:\n    try:\n        key = sw_reg.open(key_path)\n        for value in key.values():\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SOFTWARE\\\\{key_path}',\n                'type': 'Run Key',\n                'name': value.name(),\n                'value': str(value.value()),\n                'timestamp': str(key.timestamp())\n            })\n    except Exception:\n        pass\n\n# NTUSER.DAT analysis\nimport glob\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FNTUSER*.DAT\"):\n    try:\n        user_reg = Registry.Registry(ntuser)\n        user_run_keys = [\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n        ]\n        for key_path in user_run_keys:\n            try:\n                key = user_reg.open(key_path)\n                for value in key.values():\n                    results['registry_persistence'].append({\n                        'location': f'HKCU\\\\{key_path}',\n                        'type': 'User Run Key',\n                        'name': value.name(),\n                        'value': str(value.value()),\n                        'timestamp': str(key.timestamp()),\n                        'hive': ntuser\n                    })\n            except Exception:\n                pass\n    except Exception:\n        pass\n\nprint(f\"Total registry persistence entries: {len(results['registry_persistence'])}\")\nfor entry in results['registry_persistence']:\n    print(f\"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json', 'w') as f:\n    json.dump(results, f, indent=2)\nPYEOF\n```\n\n### Step 2: Check Scheduled Tasks and WMI Persistence\n\n```bash\n# Extract scheduled tasks from forensic image\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002FTasks\u002F* \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F 2>\u002Fdev\u002Fnull\n\n# Parse scheduled task XML files\npython3 \u003C\u003C 'PYEOF'\nimport os, xml.etree.ElementTree as ET\n\ntasks_dir = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F'\nsuspicious_tasks = []\n\nfor root_dir, dirs, files in os.walk(tasks_dir):\n    for fname in files:\n        fpath = os.path.join(root_dir, fname)\n        try:\n            tree = ET.parse(fpath)\n            root = tree.getroot()\n            ns = {'t': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwindows\u002F2004\u002F02\u002Fmit\u002Ftask'}\n\n            actions = root.findall('.\u002F\u002Ft:Exec', ns)\n            for action in actions:\n                command = action.find('t:Command', ns)\n                args = action.find('t:Arguments', ns)\n                cmd_text = command.text if command is not None else ''\n                args_text = args.text if args is not None else ''\n\n                # Flag suspicious commands\n                suspicious_indicators = [\n                    'powershell', 'cmd.exe', 'wscript', 'cscript', 'mshta',\n                    'regsvr32', 'rundll32', 'certutil', 'bitsadmin',\n                    '\u002Fc ', '-enc', '-e ', 'hidden', 'bypass', 'downloadstring',\n                    'invoke-', 'iex', '\u002Ftmp\u002F', 'appdata', 'programdata',\n                    'temp\\\\', '.ps1', '.vbs', '.hta', 'base64'\n                ]\n\n                is_suspicious = any(s in (cmd_text + ' ' + args_text).lower() for s in suspicious_indicators)\n\n                task_info = {\n                    'name': fname,\n                    'path': fpath.replace(tasks_dir, ''),\n                    'command': cmd_text,\n                    'arguments': args_text,\n                    'suspicious': is_suspicious\n                }\n\n                if is_suspicious:\n                    suspicious_tasks.append(task_info)\n                    print(f\"SUSPICIOUS TASK: {fname}\")\n                    print(f\"  Command: {cmd_text}\")\n                    print(f\"  Arguments: {args_text}\")\n                    print()\n\n        except Exception as e:\n            pass\n\nprint(f\"\\nTotal suspicious scheduled tasks: {len(suspicious_tasks)}\")\nPYEOF\n\n# Check WMI event subscriptions (common APT persistence)\n# WMI repository: C:\\Windows\\System32\\wbem\\Repository\\\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwbem\u002FRepository\u002F \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002F 2>\u002Fdev\u002Fnull\n\n# Parse WMI persistence using PyWMIPersistenceFinder\npython3 \u003C\u003C 'PYEOF'\nimport os, re\n\n# Search WMI OBJECTS.DATA for event subscriptions\nwmi_db = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002FOBJECTS.DATA'\nif os.path.exists(wmi_db):\n    with open(wmi_db, 'rb') as f:\n        data = f.read()\n\n    # Search for EventFilter strings\n    filters = re.findall(b'__EventFilter.*?(?=\\x00\\x00)', data)\n    consumers = re.findall(b'CommandLineEventConsumer.*?(?=\\x00\\x00)', data)\n    bindings = re.findall(b'__FilterToConsumerBinding.*?(?=\\x00\\x00)', data)\n\n    print(\"=== WMI PERSISTENCE ===\")\n    print(f\"Event Filters: {len(filters)}\")\n    print(f\"Command Consumers: {len(consumers)}\")\n    print(f\"Filter-Consumer Bindings: {len(bindings)}\")\n\n    for consumer in consumers:\n        decoded = consumer.decode('utf-8', errors='ignore')\n        print(f\"  Consumer: {decoded[:200]}\")\nelse:\n    print(\"WMI repository not found\")\nPYEOF\n```\n\n### Step 3: Check File System and Boot Persistence\n\n```bash\n# Startup folders\necho \"=== STARTUP FOLDER CONTENTS ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n\nls -la \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\n\nfor userdir in \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002F; do\n    username=$(basename \"$userdir\")\n    echo \"--- User: $username ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n    ls -la \"$userdir\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n       >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\ndone\n\n# Check DLL search order hijacking locations\necho \"=== DLL HIJACKING CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n# Check for DLLs in application directories that should only be in System32\nfind \u002Fmnt\u002Fevidence\u002FProgram\\ Files\u002F \u002Fmnt\u002Fevidence\u002FProgram\\ Files\\ \\(x86\\)\u002F \\\n   -name \"*.dll\" -newer \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fntdll.dll 2>\u002Fdev\u002Fnull \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n\n# Check for COM object hijacking\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Check for suspicious CLSID entries\ntry:\n    clsid = reg.open(\"Classes\\\\CLSID\")\n    for key in clsid.subkeys():\n        try:\n            server = key.subkey(\"InprocServer32\")\n            dll_path = server.value(\"(default)\").value()\n            if any(s in dll_path.lower() for s in ['temp', 'appdata', 'programdata', 'downloads', 'tmp']):\n                print(f\"SUSPICIOUS COM: {key.name()} -> {dll_path}\")\n        except:\n            pass\nexcept:\n    pass\nPYEOF\n\n# Check boot configuration for bootkits\n# BCD (Boot Configuration Data)\nls -la \u002Fmnt\u002Fevidence\u002FBoot\u002FBCD 2>\u002Fdev\u002Fnull\n# Check for modified bootmgr or winload.exe\nsha256sum \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinload.exe 2>\u002Fdev\u002Fnull\n```\n\n### Step 4: Check Linux Persistence Mechanisms\n\n```bash\n# If analyzing a Linux system\nLINUX_ROOT=\"\u002Fmnt\u002Fevidence\"\n\necho \"=== LINUX PERSISTENCE CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\n\n# Cron jobs\necho \"--- Cron Jobs ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fcrontab >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\nls -la $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Systemd services\necho \"--- Custom Systemd Services ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -not -type l \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# SSH authorized keys\necho \"--- SSH Authorized Keys ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fhome\u002F $LINUX_ROOT\u002Froot\u002F -name \"authorized_keys\" -exec cat {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Init scripts and rc.local\necho \"--- RC Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Frc.local >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Shell profile scripts\necho \"--- Profile Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fprofile.d\u002F*.sh >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# LD_PRELOAD\necho \"--- LD_PRELOAD ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fld.so.preload >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ngrep -r \"LD_PRELOAD\" $LINUX_ROOT\u002Fetc\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Kernel modules\necho \"--- Loaded Kernel Modules ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fmodules-load.d\u002F*.conf >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# PAM backdoors\necho \"--- PAM Configuration ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fpam.d\u002F -exec grep -l \"pam_exec\\|pam_script\" {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 5: Compile Persistence Report\n\n```bash\n# Generate comprehensive persistence report\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json') as f:\n    reg_data = json.load(f)\n\nreport = \"\"\"\nMALWARE PERSISTENCE INVESTIGATION REPORT\n==========================================\n\nPERSISTENCE MECHANISMS FOUND:\n\n1. REGISTRY RUN KEYS:\n\"\"\"\n\nrun_keys = [e for e in reg_data['registry_persistence'] if 'Run' in e.get('type', '')]\nfor entry in run_keys:\n    report += f\"   [{entry['timestamp']}] {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nservices = [e for e in reg_data['registry_persistence'] if e.get('type') == 'Service']\nreport += f\"\\n2. SERVICES ({len(services)} auto-start services):\\n\"\nfor entry in services[:20]:\n    report += f\"   {entry['location'].split('\\\\')[-1]}: {entry['value'][:100]}\\n\"\n\nreport += \"\"\"\n3. SCHEDULED TASKS: [See scheduled_tasks analysis]\n4. WMI SUBSCRIPTIONS: [See WMI analysis]\n5. STARTUP FOLDER: [See startup_items.txt]\n6. COM HIJACKING: [See COM analysis]\n\nSUSPICIOUS ENTRIES REQUIRING INVESTIGATION:\n\"\"\"\n\n# Flag suspicious entries\nfor entry in reg_data['registry_persistence']:\n    value = str(entry.get('value', '')).lower()\n    suspicious_indicators = ['powershell', 'cmd \u002Fc', 'wscript', 'certutil',\n                             'programdata', 'appdata\\\\local\\\\temp', 'base64',\n                             '.ps1', '.vbs', '.hta', '\u002Ftmp\u002F', 'hidden']\n    if any(s in value for s in suspicious_indicators):\n        report += f\"   SUSPICIOUS: {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt', 'w') as f:\n    f.write(report)\n\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Run keys | Registry keys executing programs at user logon (HKLM and HKCU) |\n| Scheduled tasks | Windows Task Scheduler entries that execute on triggers (time, event, logon) |\n| WMI event subscriptions | Persistent WMI queries that trigger actions (stealthy persistence) |\n| COM hijacking | Redirecting COM object loading to execute malicious DLLs |\n| DLL search order hijacking | Placing malicious DLLs in directories searched before System32 |\n| Service persistence | Installing Windows services that auto-start with the system |\n| Boot-level persistence | Modifying boot configuration or MBR\u002FVBR for pre-OS execution |\n| Living-off-the-land | Using legitimate system tools (PowerShell, WMI, certutil) for persistence |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autoruns | Sysinternals comprehensive autostart enumeration tool |\n| RegRipper | Automated registry persistence artifact extraction |\n| KAPE | Automated persistence artifact collection and analysis |\n| Velociraptor | Endpoint agent with persistence hunting artifacts |\n| OSQuery | SQL-based system querying for persistence enumeration |\n| PersistenceSniper | PowerShell tool for Windows persistence detection |\n| RECmd | Eric Zimmerman registry command-line analysis tool |\n| Volatility | Memory forensics for in-memory only persistence |\n\n## Common Scenarios\n\n**Scenario 1: APT Persistence After Initial Compromise**\nCheck all registry Run keys, enumerate scheduled tasks for encoded PowerShell commands, examine WMI event subscriptions for event-triggered execution, check COM object registrations for hijacked CLSIDs, review services for recently installed entries with suspicious image paths.\n\n**Scenario 2: Ransomware Pre-Encryption Persistence**\nIdentify how the ransomware maintains access for re-encryption or monitoring, check for scheduled tasks that would re-launch encryption, examine services installed by the ransomware operator, verify no additional backdoor persistence exists before declaring remediation complete.\n\n**Scenario 3: Fileless Malware Persistence**\nFocus on registry-based persistence storing payload in registry values, check WMI subscriptions executing PowerShell from event triggers, examine scheduled tasks using encoded command arguments, check for mshta\u002Frundll32 based persistence loading remote content.\n\n**Scenario 4: Post-Remediation Verification**\nRun Autoruns comparison against known-good baseline, verify all identified persistence mechanisms have been removed, check for additional persistence that may have been missed, confirm services, tasks, and registry entries are clean, monitor for re-infection indicators.\n\n## Output Format\n\n```\nPersistence Investigation Summary:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Analysis Date: 2024-01-20\n\n  Persistence Mechanisms Found:\n    Registry Run Keys (HKLM):    5 entries (1 SUSPICIOUS)\n    Registry Run Keys (HKCU):    3 entries (1 SUSPICIOUS)\n    Services (Auto-Start):       142 entries (2 SUSPICIOUS)\n    Scheduled Tasks:             67 entries (3 SUSPICIOUS)\n    WMI Subscriptions:           1 entry (SUSPICIOUS)\n    Startup Folder:              4 items (1 SUSPICIOUS)\n    COM Objects:                 0 hijacked entries\n    DLL Hijacking:               0 detected\n\n  Suspicious Entries:\n    1. HKCU\\Run\\WindowsUpdate -> powershell -ep bypass -e \u003Cbase64>\n       Timestamp: 2024-01-15 14:35:00\n       Action: Encoded PowerShell download cradle\n\n    2. Service: WinDefenderUpdate -> C:\\ProgramData\\svc\\update.exe\n       Timestamp: 2024-01-15 14:40:00\n       Action: Unknown executable in ProgramData\n\n    3. Task: \\Microsoft\\Windows\\Maintenance\\SecurityUpdate\n       Command: cmd.exe \u002Fc powershell -w hidden -e \u003Cbase64>\n       Trigger: On system startup\n\n    4. WMI: __EventFilter \"ProcessStart\" -> CommandLineEventConsumer\n       Action: Execute C:\\Windows\\Temp\\svc.exe on WMI event\n\n  Remediation Required: 4 persistence mechanisms to remove\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt\n```\n","# Performing Malware Persistence Investigation\n\n## When to Use\n- When investigating how malware maintains presence on a compromised system after reboots\n- During incident response to identify all persistence mechanisms for complete remediation\n- For threat hunting to discover unauthorized autostart entries across endpoints\n- When analyzing malware behavior to understand its persistence strategy\n- For verifying that all persistence has been removed after incident remediation\n\n## Prerequisites\n- Forensic image or live system access with administrative privileges\n- Autoruns (Sysinternals) for Windows persistence enumeration\n- RegRipper for offline registry analysis\n- Understanding of Windows and Linux persistence mechanisms\n- YARA rules for scanning persistence locations\n- Baseline of known-good autorun entries for comparison\n\n## Workflow\n\n### Step 1: Enumerate Windows Registry Persistence\n\n```bash\n# Extract registry hives from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Key registry persistence locations\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nresults = {'registry_persistence': []}\n\n# SYSTEM hive analysis\nsystem_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSYSTEM\")\nselect = system_reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncs = f\"ControlSet{current:03d}\"\n\n# Services (very common persistence)\nservices = system_reg.open(f\"{cs}\\\\Services\")\nfor svc in services.subkeys():\n    try:\n        start_type = svc.value(\"Start\").value()\n        image_path = \"\"\n        try:\n            image_path = svc.value(\"ImagePath\").value()\n        except:\n            pass\n        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled\n        if start_type in (0, 1, 2) and image_path:\n            svc_type = svc.value(\"Type\").value() if svc.values() else 0\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SYSTEM\\\\{cs}\\\\Services\\\\{svc.name()}',\n                'type': 'Service',\n                'value': image_path,\n                'start_type': start_type,\n                'timestamp': str(svc.timestamp())\n            })\n    except Exception:\n        pass\n\n# SOFTWARE hive analysis\nsw_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Machine Run keys\nrun_keys = [\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n]\n\nfor key_path in run_keys:\n    try:\n        key = sw_reg.open(key_path)\n        for value in key.values():\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SOFTWARE\\\\{key_path}',\n                'type': 'Run Key',\n                'name': value.name(),\n                'value': str(value.value()),\n                'timestamp': str(key.timestamp())\n            })\n    except Exception:\n        pass\n\n# NTUSER.DAT analysis\nimport glob\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FNTUSER*.DAT\"):\n    try:\n        user_reg = Registry.Registry(ntuser)\n        user_run_keys = [\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n        ]\n        for key_path in user_run_keys:\n            try:\n                key = user_reg.open(key_path)\n                for value in key.values():\n                    results['registry_persistence'].append({\n                        'location': f'HKCU\\\\{key_path}',\n                        'type': 'User Run Key',\n                        'name': value.name(),\n                        'value': str(value.value()),\n                        'timestamp': str(key.timestamp()),\n                        'hive': ntuser\n                    })\n            except Exception:\n                pass\n    except Exception:\n        pass\n\nprint(f\"Total registry persistence entries: {len(results['registry_persistence'])}\")\nfor entry in results['registry_persistence']:\n    print(f\"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json', 'w') as f:\n    json.dump(results, f, indent=2)\nPYEOF\n```\n\n### Step 2: Check Scheduled Tasks and WMI Persistence\n\n```bash\n# Extract scheduled tasks from forensic image\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002FTasks\u002F* \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F 2>\u002Fdev\u002Fnull\n\n# Parse scheduled task XML files\npython3 \u003C\u003C 'PYEOF'\nimport os, xml.etree.ElementTree as ET\n\ntasks_dir = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F'\nsuspicious_tasks = []\n\nfor root_dir, dirs, files in os.walk(tasks_dir):\n    for fname in files:\n        fpath = os.path.join(root_dir, fname)\n        try:\n            tree = ET.parse(fpath)\n            root = tree.getroot()\n            ns = {'t': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwindows\u002F2004\u002F02\u002Fmit\u002Ftask'}\n\n            actions = root.findall('.\u002F\u002Ft:Exec', ns)\n            for action in actions:\n                command = action.find('t:Command', ns)\n                args = action.find('t:Arguments', ns)\n                cmd_text = command.text if command is not None else ''\n                args_text = args.text if args is not None else ''\n\n                # Flag suspicious commands\n                suspicious_indicators = [\n                    'powershell', 'cmd.exe', 'wscript', 'cscript', 'mshta',\n                    'regsvr32', 'rundll32', 'certutil', 'bitsadmin',\n                    '\u002Fc ', '-enc', '-e ', 'hidden', 'bypass', 'downloadstring',\n                    'invoke-', 'iex', '\u002Ftmp\u002F', 'appdata', 'programdata',\n                    'temp\\\\', '.ps1', '.vbs', '.hta', 'base64'\n                ]\n\n                is_suspicious = any(s in (cmd_text + ' ' + args_text).lower() for s in suspicious_indicators)\n\n                task_info = {\n                    'name': fname,\n                    'path': fpath.replace(tasks_dir, ''),\n                    'command': cmd_text,\n                    'arguments': args_text,\n                    'suspicious': is_suspicious\n                }\n\n                if is_suspicious:\n                    suspicious_tasks.append(task_info)\n                    print(f\"SUSPICIOUS TASK: {fname}\")\n                    print(f\"  Command: {cmd_text}\")\n                    print(f\"  Arguments: {args_text}\")\n                    print()\n\n        except Exception as e:\n            pass\n\nprint(f\"\\nTotal suspicious scheduled tasks: {len(suspicious_tasks)}\")\nPYEOF\n\n# Check WMI event subscriptions (common APT persistence)\n# WMI repository: C:\\Windows\\System32\\wbem\\Repository\\\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwbem\u002FRepository\u002F \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002F 2>\u002Fdev\u002Fnull\n\n# Parse WMI persistence using PyWMIPersistenceFinder\npython3 \u003C\u003C 'PYEOF'\nimport os, re\n\n# Search WMI OBJECTS.DATA for event subscriptions\nwmi_db = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002FOBJECTS.DATA'\nif os.path.exists(wmi_db):\n    with open(wmi_db, 'rb') as f:\n        data = f.read()\n\n    # Search for EventFilter strings\n    filters = re.findall(b'__EventFilter.*?(?=\\x00\\x00)', data)\n    consumers = re.findall(b'CommandLineEventConsumer.*?(?=\\x00\\x00)', data)\n    bindings = re.findall(b'__FilterToConsumerBinding.*?(?=\\x00\\x00)', data)\n\n    print(\"=== WMI PERSISTENCE ===\")\n    print(f\"Event Filters: {len(filters)}\")\n    print(f\"Command Consumers: {len(consumers)}\")\n    print(f\"Filter-Consumer Bindings: {len(bindings)}\")\n\n    for consumer in consumers:\n        decoded = consumer.decode('utf-8', errors='ignore')\n        print(f\"  Consumer: {decoded[:200]}\")\nelse:\n    print(\"WMI repository not found\")\nPYEOF\n```\n\n### Step 3: Check File System and Boot Persistence\n\n```bash\n# Startup folders\necho \"=== STARTUP FOLDER CONTENTS ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n\nls -la \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\n\nfor userdir in \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002F; do\n    username=$(basename \"$userdir\")\n    echo \"--- User: $username ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n    ls -la \"$userdir\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n       >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\ndone\n\n# Check DLL search order hijacking locations\necho \"=== DLL HIJACKING CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n# Check for DLLs in application directories that should only be in System32\nfind \u002Fmnt\u002Fevidence\u002FProgram\\ Files\u002F \u002Fmnt\u002Fevidence\u002FProgram\\ Files\\ \\(x86\\)\u002F \\\n   -name \"*.dll\" -newer \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fntdll.dll 2>\u002Fdev\u002Fnull \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n\n# Check for COM object hijacking\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Check for suspicious CLSID entries\ntry:\n    clsid = reg.open(\"Classes\\\\CLSID\")\n    for key in clsid.subkeys():\n        try:\n            server = key.subkey(\"InprocServer32\")\n            dll_path = server.value(\"(default)\").value()\n            if any(s in dll_path.lower() for s in ['temp', 'appdata', 'programdata', 'downloads', 'tmp']):\n                print(f\"SUSPICIOUS COM: {key.name()} -> {dll_path}\")\n        except:\n            pass\nexcept:\n    pass\nPYEOF\n\n# Check boot configuration for bootkits\n# BCD (Boot Configuration Data)\nls -la \u002Fmnt\u002Fevidence\u002FBoot\u002FBCD 2>\u002Fdev\u002Fnull\n# Check for modified bootmgr or winload.exe\nsha256sum \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinload.exe 2>\u002Fdev\u002Fnull\n```\n\n### Step 4: Check Linux Persistence Mechanisms\n\n```bash\n# If analyzing a Linux system\nLINUX_ROOT=\"\u002Fmnt\u002Fevidence\"\n\necho \"=== LINUX PERSISTENCE CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\n\n# Cron jobs\necho \"--- Cron Jobs ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fcrontab >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\nls -la $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Systemd services\necho \"--- Custom Systemd Services ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -not -type l \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# SSH authorized keys\necho \"--- SSH Authorized Keys ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fhome\u002F $LINUX_ROOT\u002Froot\u002F -name \"authorized_keys\" -exec cat {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Init scripts and rc.local\necho \"--- RC Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Frc.local >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Shell profile scripts\necho \"--- Profile Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fprofile.d\u002F*.sh >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# LD_PRELOAD\necho \"--- LD_PRELOAD ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fld.so.preload >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ngrep -r \"LD_PRELOAD\" $LINUX_ROOT\u002Fetc\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Kernel modules\necho \"--- Loaded Kernel Modules ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fmodules-load.d\u002F*.conf >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# PAM backdoors\necho \"--- PAM Configuration ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fpam.d\u002F -exec grep -l \"pam_exec\\|pam_script\" {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 5: Compile Persistence Report\n\n```bash\n# Generate comprehensive persistence report\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json') as f:\n    reg_data = json.load(f)\n\nreport = \"\"\"\nMALWARE PERSISTENCE INVESTIGATION REPORT\n==========================================\n\nPERSISTENCE MECHANISMS FOUND:\n\n1. REGISTRY RUN KEYS:\n\"\"\"\n\nrun_keys = [e for e in reg_data['registry_persistence'] if 'Run' in e.get('type', '')]\nfor entry in run_keys:\n    report += f\"   [{entry['timestamp']}] {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nservices = [e for e in reg_data['registry_persistence'] if e.get('type') == 'Service']\nreport += f\"\\n2. SERVICES ({len(services)} auto-start services):\\n\"\nfor entry in services[:20]:\n    report += f\"   {entry['location'].split('\\\\')[-1]}: {entry['value'][:100]}\\n\"\n\nreport += \"\"\"\n3. SCHEDULED TASKS: [See scheduled_tasks analysis]\n4. WMI SUBSCRIPTIONS: [See WMI analysis]\n5. STARTUP FOLDER: [See startup_items.txt]\n6. COM HIJACKING: [See COM analysis]\n\nSUSPICIOUS ENTRIES REQUIRING INVESTIGATION:\n\"\"\"\n\n# Flag suspicious entries\nfor entry in reg_data['registry_persistence']:\n    value = str(entry.get('value', '')).lower()\n    suspicious_indicators = ['powershell', 'cmd \u002Fc', 'wscript', 'certutil',\n                             'programdata', 'appdata\\\\local\\\\temp', 'base64',\n                             '.ps1', '.vbs', '.hta', '\u002Ftmp\u002F', 'hidden']\n    if any(s in value for s in suspicious_indicators):\n        report += f\"   SUSPICIOUS: {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt', 'w') as f:\n    f.write(report)\n\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Run keys | Registry keys executing programs at user logon (HKLM and HKCU) |\n| Scheduled tasks | Windows Task Scheduler entries that execute on triggers (time, event, logon) |\n| WMI event subscriptions | Persistent WMI queries that trigger actions (stealthy persistence) |\n| COM hijacking | Redirecting COM object loading to execute malicious DLLs |\n| DLL search order hijacking | Placing malicious DLLs in directories searched before System32 |\n| Service persistence | Installing Windows services that auto-start with the system |\n| Boot-level persistence | Modifying boot configuration or MBR\u002FVBR for pre-OS execution |\n| Living-off-the-land | Using legitimate system tools (PowerShell, WMI, certutil) for persistence |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autoruns | Sysinternals comprehensive autostart enumeration tool |\n| RegRipper | Automated registry persistence artifact extraction |\n| KAPE | Automated persistence artifact collection and analysis |\n| Velociraptor | Endpoint agent with persistence hunting artifacts |\n| OSQuery | SQL-based system querying for persistence enumeration |\n| PersistenceSniper | PowerShell tool for Windows persistence detection |\n| RECmd | Eric Zimmerman registry command-line analysis tool |\n| Volatility | Memory forensics for in-memory only persistence |\n\n## Common Scenarios\n\n**Scenario 1: APT Persistence After Initial Compromise**\nCheck all registry Run keys, enumerate scheduled tasks for encoded PowerShell commands, examine WMI event subscriptions for event-triggered execution, check COM object registrations for hijacked CLSIDs, review services for recently installed entries with suspicious image paths.\n\n**Scenario 2: Ransomware Pre-Encryption Persistence**\nIdentify how the ransomware maintains access for re-encryption or monitoring, check for scheduled tasks that would re-launch encryption, examine services installed by the ransomware operator, verify no additional backdoor persistence exists before declaring remediation complete.\n\n**Scenario 3: Fileless Malware Persistence**\nFocus on registry-based persistence storing payload in registry values, check WMI subscriptions executing PowerShell from event triggers, examine scheduled tasks using encoded command arguments, check for mshta\u002Frundll32 based persistence loading remote content.\n\n**Scenario 4: Post-Remediation Verification**\nRun Autoruns comparison against known-good baseline, verify all identified persistence mechanisms have been removed, check for additional persistence that may have been missed, confirm services, tasks, and registry entries are clean, monitor for re-infection indicators.\n\n## Output Format\n\n```\nPersistence Investigation Summary:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Analysis Date: 2024-01-20\n\n  Persistence Mechanisms Found:\n    Registry Run Keys (HKLM):    5 entries (1 SUSPICIOUS)\n    Registry Run Keys (HKCU):    3 entries (1 SUSPICIOUS)\n    Services (Auto-Start):       142 entries (2 SUSPICIOUS)\n    Scheduled Tasks:             67 entries (3 SUSPICIOUS)\n    WMI Subscriptions:           1 entry (SUSPICIOUS)\n    Startup Folder:              4 items (1 SUSPICIOUS)\n    COM Objects:                 0 hijacked entries\n    DLL Hijacking:               0 detected\n\n  Suspicious Entries:\n    1. HKCU\\Run\\WindowsUpdate -> powershell -ep bypass -e \u003Cbase64>\n       Timestamp: 2024-01-15 14:35:00\n       Action: Encoded PowerShell download cradle\n\n    2. Service: WinDefenderUpdate -> C:\\ProgramData\\svc\\update.exe\n       Timestamp: 2024-01-15 14:40:00\n       Action: Unknown executable in ProgramData\n\n    3. Task: \\Microsoft\\Windows\\Maintenance\\SecurityUpdate\n       Command: cmd.exe \u002Fc powershell -w hidden -e \u003Cbase64>\n       Trigger: On system startup\n\n    4. WMI: __EventFilter \"ProcessStart\" -> CommandLineEventConsumer\n       Action: Execute C:\\Windows\\Temp\\svc.exe on WMI event\n\n  Remediation Required: 4 persistence mechanisms to remove\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt\n```\n",{"name":5,"tags":44,"author":48,"domain":38,"license":15,"version":49,"category":5,"nist_csf":50,"subdomain":55,"description":7,"mitre_attack":56},[35,33,34,45,46,24,47],"registry","scheduled-tasks","incident-response","mahipal","1.0",[51,52,53,54],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[57,58,59,60,61],"T1005","T1074","T1119","T1070","T1547","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fperforming-malware-persistence-investigation",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill performing-malware-persistence-investigation",{"tool":76,"command":77},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill performing-malware-persistence-investigation",{"tool":79,"command":80},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill performing-malware-persistence-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-malware-persistence-investigation\u002FSKILL.md",true,[84,89,95],{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-malware-persistence-investigation\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",1896,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-malware-persistence-investigation\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",9488,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-malware-persistence-investigation\u002Fscripts\u002Fagent.py",[102,131,157,180,196,216],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":113,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[108],{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[114,115,116,117,118,119,38,120,121,122,47,123,124,125,126,127,128,28,129,130],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","ransomware","detection","t1078","t1490","disaster-recovery","restore","disaster recovery","ransomware response",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[138,139,140,141,142,38,143,144,145,146,147,148,149,150,151,152,153,154,155,156],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[164,165,28,38,166,167,168,125,126,169,170,171,172,173,174,175,176,177,178,179],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[164,187,188,165,28,142,38,189,167,47,190,191,125,126,192,170,152,193,194,195],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[164,203,204,205,206,207,38,208,209,210,167,211,125,212,213,214,173,215,28,26],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":222,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[223,224,225,226,38,227,228,229,230,231,232,212,233,234,215,235,26,236,237,238],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]